Threat model! Firefox indeed does excel for the average citizen in terms of security. While people that know some infosec think CVE count and exploit mitigation is a priority. It has auto update for known vulns, for 0days,people who are targeted by attackers willing to burn a browser 0day on them have a drastically different threat model than the average citizen and frankly using Chrome because of CVE count is a bad strategy if you're one of those people (bromium,qubes os and other segregation based appsec is worth a consideration).
You have to appreciate how much privacy counts (Chrome failed telemetry on the BSI test)
This is not completely ridiculous, but it’s exactly the sort of silliness you’d expect from bureaucrats (and zdnet!)
Firefox isn’t the most secure browser, it just checks the most boxes on this particular compliance checklist which doesn’t really assess the security of the browser.
They provide arguments and data points why Firefox is the most secure browser. This is not silly, but allows to have a good discussion. Care sharing other evaluation results from reputable sources?
Which boxes on this checklist are not components of browser security? I'm nothing like an expert on cybersecurity, but they generally seem relevant to me.
My objection really has nothing to do with the specific boxes. This is just fundamentally the wrong approach, as is demonstrated by the fact that every browser except IE essentially got a perfect score except for telemetry.
Do you see a site isolation checkbox there btw? Missing one of the most important exploit mitigation technologies for browsers today strongly suggests that whoever made this list was either incompetent or deliberately picking boxes that firefox ticks.
I'd assume that instead of having actual browser security experts build this list they had some amateurs attempt to build a list of existing security "features" in browsers, which isn't a sane approach at all and is bound to get results like this. A good checklist would almost certainly have lots of boxes nobody ticks.
I'd argue that depends entirely on the contents of the telemetry, which don't appear to be a part of this assessment. Besides (since this isn't about defaults), if you're configuring your browser to disable telemetry couldn't you just as well configure your firewall to block it?
Automatic updates also tend to leak information by design.
But anyway, this has nothing to do with my larger point. A good checklist would certainly have lots of boxes nobody ticks, this one was clearly built around firefox feature lists (and maybe others, but not chrome as site isolation is left out).
You have to appreciate how much privacy counts (Chrome failed telemetry on the BSI test)